AI found a 27‑year‑old OpenBSD bug for $50
In April 2026 an AI model found a flaw in OpenBSD's TCP stack that had survived 27 years of expert review. The run that surfaced it cost under $50.
In April 2026, an AI model found a serious flaw in OpenBSD's networking code that twenty-seven years of expert review and millions of automated tests had missed. OpenBSD is the operating system that treats security as its entire reason to exist. The model run that surfaced the bug cost less than fifty dollars. That number is the story.
What was found
The flaw sat in OpenBSD's TCP stack, the core code that handles network connections, and it had survived since the 1990s. Anthropic's Claude Mythos Preview found and exploited it autonomously, then went on to report thousands of similar zero-day flaws across every major operating system and browser. Code read by thousands of careful engineers over decades turned out to still hold a live bug, and a machine found it in a single run.
Why the cost matters more than the bug
A serious vulnerability in OpenBSD is remarkable. A serious vulnerability found for the price of lunch is a change in the weather. For as long as security has existed, the cost of finding a deep flaw was a skilled specialist and weeks of their time. That cost was the reason most bugs stayed hidden: it was not worth anyone's while to look. When looking becomes cheap and fast, everything protected only by obscurity is suddenly exposed.
The cost of finding a serious bug fell to the price of lunch.MATT Research
The pattern
Two ideas follow. First, 'reviewed for decades' is not the same as 'secure today', because the tool doing the reviewing just changed. Second, whatever a defender can now find cheaply, an attacker can find cheaply too, and the one who looks first wins. The answer is to test continuously, with the same class of tool the attackers hold, and to keep the rules holding as the code changes. We test a live product the way a modern model would and turn what we find into plain-English rules re-proven on every release. This account draws on Anthropic's announcement ↗ and VentureBeat's reporting ↗; both are linked from the Record.
Questions
Did an AI really find a 27‑year‑old OpenBSD bug?
Yes. In April 2026, Anthropic's Claude Mythos Preview autonomously found and exploited a flaw in OpenBSD's TCP stack that had survived 27 years of review and extensive fuzz testing. The same model reported thousands of zero-day flaws across major operating systems and browsers.
Why does the $50 figure matter so much?
Because it changes who can afford to look. Finding a deep flaw used to require a skilled specialist and weeks of effort, which is why many bugs stayed hidden. When the cost drops to the price of lunch, anything protected only by the difficulty of looking is now exposed.
Is OpenBSD insecure?
OpenBSD is one of the most security-focused operating systems there is, which is the point. If a serious flaw could hide for 27 years in code this carefully reviewed, then long-standing review is no longer proof that code is safe against today's tools.
What should this change for security teams?
The cadence. A once-a-year review made sense when finding bugs was slow and expensive. When discovery is cheap and continuous, testing has to be continuous too, using the same class of model an attacker would use.
Who else can use this capability?
Anyone who can run the model. The same tool that lets a defender find and fix flaws quickly lets an attacker find them just as quickly. The advantage goes to whoever looks first.